             [ctia.stores.es
              [mapping :as em]
              [store :refer [def-es-store]]]
+            [ctim.schemas.common :refer [IdentitySpecification]]
             [ctim.schemas.investigation :as inv]
             [flanders
              [schema :as f-schema]

                :include_in_all false}
   :targets {:type "nested"
             :include_in_all false}
   :investigated_observables {:type "nested"
                              :include_in_all false}})

(def investigation-mapping

(s/defschema Investigation
  (st/merge (f-schema/->schema inv/Investigation)
            CTIAEntity
            {(s/required-key :actions) (s/either s/Str {s/Keyword s/Any})
             (s/required-key :object_ids) [s/Str]
             ;; "type:value"
             (s/required-key :investigated_observables [s/Str])
             (s/required-key :targets [(f-schema/->schema IdentitySpecification)])
             s/Keyword s/Any}))

(f-spec/->spec inv/Investigation "investigation")

